Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware
The Free Software Foundation took the GNU Boot project under its wing in September 2026, providing both financial backing and legal support for the effort to create a fully free firmware replacement for conventional BIOS and UEFI.
When a computer powers on, the motherboard firmware is the first code to execute. It initializes memory, the CPU, controllers, and the video adapter before handing control to the bootloader. Almost all current implementations are distributed only as closed binaries, making inspection or modification difficult and often blocked by hardware or cryptographic protections.
Security and Freedom Concerns with Closed Firmware
Modern Intel and AMD processors contain autonomous subsystems—Intel Management Engine and AMD Platform Security Processor—that start before the main operating system. These components have full access to system memory and sometimes network interfaces, yet their code remains entirely proprietary. Users must trust vendors regarding the absence of vulnerabilities or intentional backdoors.
Additional problems include manufacturer-imposed Wi-Fi whitelist restrictions, blocked boot-device selection, and automatic firmware updates that cannot be rolled back. These behaviors have been documented on devices from several vendors, notably HP.
What GNU Boot Provides
GNU Boot is a ready-to-flash firmware image built exclusively from free software components. The hardware-initialization layer is supplied by coreboot, while the bootloader is typically GRUB or SeaBIOS. The project was founded in 2022 by Denis Karikli and Adrien Bourma after a community split from Libreboot, which began accepting binary blobs to increase hardware compatibility. GNU Boot follows strict GNU criteria that forbid any non-free code or build tools.
Comparison with Related Projects
coreboot offers broad device support but often requires closed blobs for video initialization or Management Engine components on many platforms. Libreboot supplies pre-built images and simpler installation procedures yet permits proprietary modules for wider hardware coverage. GNU Boot rejects such compromises, resulting in a narrower but fully free set of supported systems.
Currently Supported Hardware
- ThinkPad X200, X200s, X200 Tablet, T400, T500, X60 series
- Early Apple models: MacBook 1.1, 2.1 and iMac 5,2
- AMD Family 15h boards such as KGPE-D16 and KCMA-D8
- Selected desktop boards including GA-G41M-ES2L and D945GCLF
- Limited experimental server configurations
Newer platforms after 2013–2014 are generally unsupported because Intel Boot Guard and equivalent AMD mechanisms verify firmware signatures before execution, and open-source memory initialization code does not exist for recent chipsets.
While widespread adoption of fully free firmware remains distant, initiatives such as Google’s use of coreboot in Chromebooks and offerings from certain Linux-focused laptop vendors demonstrate growing interest. If demand increases, manufacturers may begin designing boards with open firmware in mind.
Related articles
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.